Heap-based Out-of-Bounds Read in MQTT-C Affects LiamBindle Products
CVE-2026-54412

7.8HIGH

Key Information:

Vendor

Liambindle

Status
MQtt-c
Vendor
CVE Published:
14 June 2026

What is CVE-2026-54412?

An out-of-bounds read vulnerability exists in the mqtt_unpack_publish_response() function within MQTT-C, affecting versions up to 1.1.6. This flaw arises from inadequate validation of the topic_name_size extracted from incoming PUBLISH packets, allowing attackers to exploit the protocol. By sending a specifically crafted PUBLISH packet, an unauthenticated remote attacker can trigger an integer underflow, leading to a crash of the MQTT-C client and potentially exposing sensitive adjacent heap memory. This risk is compounded by using unencrypted sessions, which increase susceptibility to malicious MQTT traffic injections. Users are advised to review their implementations immediately.

Affected Version(s)

MQTT-C 0 <= 1.1.6

References

https://github.com/LiamBindle/MQTT-C
product
https://github.com/LiamBindle/MQTT-C/blob/v1.1.6/src/mqtt...
product
https://cwe.mitre.org/data/definitions/125.html
technical-description

CVSS V4

Score:
7.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Saidakbarxon Maxsudxonov
.